pactkit 2.3.4__tar.gz → 2.3.6__tar.gz

{pactkit-2.3.4 → pactkit-2.3.6}/.opencode/pactkit.yaml

@@ -2,7 +2,7 @@
 # Edit this file to customize which components are deployed.
 # Remove items from a list to disable them. Default: all enabled.
 
-version: "2.3.4"
+version: "2.3.6"
 stack: python
 root: .
 developer: "slim"

{pactkit-2.3.4 → pactkit-2.3.6}/CHANGELOG.md

@@ -4,6 +4,25 @@ All notable changes to PactKit will be documented in this file.
 
 Format follows [Keep a Changelog](https://keepachangelog.com/).
 
+## [2.3.6] - 2026-03-24
+
+### Fixed
+- **Issue Sync Substring Matching** (STORY-slim-027 R1) — `issue_sync.py` now uses word-boundary regex instead of `in` substring check, preventing `STORY-1` from matching `STORY-10`.
+- **E007 Per-Subsection GWT Check** (R3) — Spec linter E007 now validates Given/When/Then keywords per AC subsection instead of flat-scanning the entire Acceptance Criteria section. Uses raw text (with code fences) to avoid false positives on specs wrapping Gherkin in ` ```gherkin ` blocks.
+- **W008 Scaffold Placeholder Detection** (R4) — New warning W008 fires when `## Background` or `## Target Call Chain` still contains default scaffold placeholder text.
+- **Schema-Linter Alignment** (R2/R10) — `## Security Scope` moved from OPTIONAL to REQUIRED in `schemas.py` to match E009 enforcement; `## Non-Goals` added to OPTIONAL.
+- **RFC Pattern Consistency** (R11) — Spec linter fallback RFC pattern now derived from `SPEC_RFC_KEYWORDS` tuple instead of a separate hardcoded regex.
+- **Scaffold Skill Path** (R8) — `scaffold.py` usage hint now uses resolved `root` path instead of hardcoded `~/.claude/skills/`.
+
+### Changed
+- **Design Prompt** (R5) — Phase 3 now includes `pactkit sec-scope` step after filling each Spec.
+- **Act Prompt** (R6/R7) — Phase 0.6 adds "Move to In Progress" board step; Phase 3 adds lint gate before regression.
+
+## [2.3.5] - 2026-03-23
+
+### Fixed
+- **W007 RFC 2119 Detection** — W007 now detects all RFC 2119 keywords (MUST, SHOULD, MAY, SHALL, REQUIRED, RECOMMENDED, OPTIONAL) using canonical `SPEC_RFC_KEYWORDS` from schemas.py, instead of hardcoding only SHOULD.
+
 ## [2.3.4] - 2026-03-23
 
 ### Added

{pactkit-2.3.4 → pactkit-2.3.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pactkit
-Version: 2.3.4
+Version: 2.3.6
 Summary: Spec-driven agentic DevOps toolkit for AI coding assistants
 Project-URL: Homepage, https://pactkit.dev
 Project-URL: Repository, https://github.com/pactkit/pactkit

pactkit-2.3.6/docs/specs/BUG-slim-007.md

@@ -0,0 +1,138 @@
+# BUG-slim-007: W007 substring matching causes false negatives and inconsistency
+
+| Field | Value |
+|-------|-------|
+| ID | BUG-slim-007 |
+| Status | Draft |
+| Priority | P1 |
+| Release | 2.3.6 |
+| Origin | Cross-model code review (2026-03-24) |
+
+## Background
+
+W007 (Req-AC coverage check) was introduced in STORY-slim-024 (v2.3.4) and patched in v2.3.5 to use `SPEC_RFC_KEYWORDS` instead of hardcoded `SHOULD`. Code review found that the implementation uses Python `in` (substring) matching in two places where word-boundary regex is required, plus a pattern divergence from the canonical source.
+
+### Bug 1: R{N} coverage check — substring false negative
+
+`spec_linter.py:241`:
+```python
+if req_id.lower() not in ac_lower:
+```
+
+When AC section mentions `R10`, the string `"r1"` is a substring of `"r10"` — so `R1` is falsely reported as covered. Similarly `"r1" in "r12"`, `"r2" in "r20"`, etc. Also non-R prefixed text like `"CR1"`, `"ERROR1"`, `"PR1"` would suppress W007 for `R1`.
+
+**Impact**: Any spec with 10+ requirements silently passes W007 for R1-R9 when R10+ exists in AC. This directly undermines W007's purpose.
+
+### Bug 2: RFC keyword detection — substring inconsistency with W003
+
+`spec_linter.py:244`:
+```python
+found_keyword = next((kw for kw in SPEC_RFC_KEYWORDS if kw in req_upper), None)
+```
+
+W003 at line 172 uses `_RFC2119.search(body)` which is `SPEC_RFC_PATTERN` — a compiled regex with `\b` word boundaries. W007 uses plain `kw in req_upper` (substring). This means `"MAYONNAISE"` matches `MAY`, `"SHALLOW"` matches `SHALL`, etc.
+
+Two rules in the same file detecting RFC 2119 keywords with different strategies is a consistency violation.
+
+### Bug 3: _REQ_ID_PATTERN diverges from SPEC_REQUIREMENT_PATTERN
+
+`spec_linter.py:203`:
+```python
+_REQ_ID_PATTERN = re.compile(r"###\s+(R\d+)[:\s]", re.MULTILINE)
+```
+
+`schemas.py:32`:
+```python
+SPEC_REQUIREMENT_PATTERN = r"### R\d+[:\s]"
+```
+
+E004 uses `SPEC_REQUIREMENT_PATTERN` (literal single space after `###`), while W007 uses `_REQ_ID_PATTERN` (`\s+` — allows tab, multiple spaces). A heading `###  R1:` (double space) would be found by W007 but missed by E004. Both patterns should derive from the same canonical source.
+
+## Requirements
+
+### R1: Word-boundary matching for R{N} coverage (MUST)
+
+W007 MUST use word-boundary regex to check whether an R{N} ID appears in the AC section. `R1` MUST NOT match `R10`, `R12`, `CR1`, `ERROR1`, or any other superstring.
+
+Pattern: `re.search(rf"\b{req_id}\b", ac_section, re.IGNORECASE)`
+
+### R2: Word-boundary matching for RFC 2119 keywords (MUST)
+
+W007's RFC 2119 keyword detection MUST use `SPEC_RFC_PATTERN` (from `schemas.py`) — the same compiled regex with `\b` word boundaries that W003 already uses. `MAY` MUST NOT match `MAYONNAISE`.
+
+### R3: _REQ_ID_PATTERN MUST derive from SPEC_REQUIREMENT_PATTERN (SHOULD)
+
+`_REQ_ID_PATTERN` SHOULD be constructed from `SPEC_REQUIREMENT_PATTERN` or share the same whitespace semantics, so that E004 and W007 agree on what constitutes a valid `### R{N}` heading.
+
+If intentional divergence is needed (e.g., W007 is more tolerant), document the reason inline.
+
+### R4: Test coverage for multi-digit R{N} (MUST)
+
+Tests MUST include a spec with R1 through R10+ where only R10 is referenced in AC, to verify R1 is correctly flagged as uncovered.
+
+### R5: Test coverage for all 7 RFC 2119 keywords (SHOULD)
+
+Tests SHOULD cover all 7 keywords from `SPEC_RFC_KEYWORDS`, not just MUST/SHOULD/MAY. Tests SHOULD also cover the no-keyword case (empty emphasis).
+
+## Acceptance Criteria
+
+### AC1: R1 not falsely covered by R10 (R1, R4)
+
+- **Given** a spec with `### R1: First` and `### R10: Tenth` in Requirements
+- **When** AC section mentions only `R10` (not `R1`)
+- **Then** W007 fires for R1 with message "Requirement R1 has no corresponding AC reference"
+- **And** W007 does NOT fire for R10
+
+### AC2: Non-R prefix text does not suppress W007 (R1)
+
+- **Given** a spec with `### R1: Something` in Requirements
+- **When** AC section contains `ERROR1` or `CR1` but not standalone `R1`
+- **Then** W007 fires for R1
+
+### AC3: RFC keyword word-boundary (R2)
+
+- **Given** a spec with unreferenced `### R1: The system MAYONNAISE handler`
+- **When** spec linter runs
+- **Then** W007 message does NOT contain `(MAY)` — substring `MAY` inside `MAYONNAISE` is not a match
+- **And** emphasis is empty (no RFC keyword found)
+
+### AC4: All 7 RFC keywords detected (R2, R5)
+
+- **Given** specs with unreferenced requirements containing each of: MUST, SHOULD, MAY, SHALL, REQUIRED, RECOMMENDED, OPTIONAL
+- **When** spec linter runs
+- **Then** each W007 message contains the correct keyword in parentheses: `(MUST)`, `(SHOULD)`, etc.
+
+### AC5: W003 and W007 use same detection mechanism (R2)
+
+- **Given** the spec_linter.py source code
+- **When** inspecting both W003 and W007 RFC 2119 detection
+- **Then** both use `SPEC_RFC_PATTERN` (or `_RFC2119` alias) for matching — no plain `kw in string`
+
+### AC6: Existing tests still pass (regression)
+
+- **Given** all pre-existing tests in test_story_slim024.py and test_story042_spec_linter.py
+- **When** running the full test suite
+- **Then** all tests pass — no regressions from word-boundary change
+
+## Implementation Steps
+
+| Step | File | Action | Dependencies | Risk |
+|------|------|--------|-------------|------|
+| 1 | `src/pactkit/skills/spec_linter.py:241` | Replace `req_id.lower() not in ac_lower` with `re.search(rf"\b{re.escape(req_id)}\b", ac_section, re.IGNORECASE)` | None | Low |
+| 2 | `src/pactkit/skills/spec_linter.py:244` | Replace `next((kw for kw in SPEC_RFC_KEYWORDS if kw in req_upper), None)` with `SPEC_RFC_PATTERN.search(req_body)` using match group | Step 1 | Low |
+| 3 | `src/pactkit/skills/spec_linter.py:203` | Add inline comment documenting why `_REQ_ID_PATTERN` uses `\s+` vs `SPEC_REQUIREMENT_PATTERN`'s literal space, or unify | None | Low |
+| 4 | `tests/unit/test_story_slim024.py` | Add R10 multi-digit test (AC1), non-R-prefix test (AC2), MAYONNAISE test (AC3), all-7-keywords test (AC4), no-keyword test (AC5 empty emphasis) | Steps 1-2 | Low |
+| 5 | `tests/unit/test_story_slim024.py` | Migrate from `tempfile.NamedTemporaryFile(delete=False)` to pytest `tmp_path` fixture (consistency with test_story042) | None | Low |
+
+## Security Scope
+
+| Check | Applicable | Reason |
+|-------|------------|--------|
+| SEC-1~8 | No | Lint rule logic change, no I/O or auth |
+
+## Out of Scope
+
+- `_section_text()` returning heading line (fragile but extremely unlikely to cause false suppression)
+- Sectional write rule 150 vs 300 inconsistency in `rules.py:359` (trivial fix, separate commit)
+- `config.py:961` api_spec empty string default (docs already fixed, code default is cosmetic)
+- Board archive section ordering (functional, not a bug)

{pactkit-2.3.4 → pactkit-2.3.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "pactkit"
-version = "2.3.4"
+version = "2.3.6"
 description = "Spec-driven agentic DevOps toolkit for AI coding assistants"
 readme = "README.md"
 license = "MIT"

{pactkit-2.3.4 → pactkit-2.3.6}/src/pactkit/__init__.py

@@ -1,3 +1,3 @@
 """PactKit - Spec-driven agentic DevOps toolkit."""
 
-__version__ = "2.3.4"
+__version__ = "2.3.6"

{pactkit-2.3.4 → pactkit-2.3.6}/src/pactkit/issue_sync.py

@@ -5,6 +5,7 @@ Replaces prompt-based issue tracker verification from Done Phase 3.5.5/3.6.
 from __future__ import annotations
 
 import json
+import re
 import subprocess
 from pathlib import Path
 
@@ -68,7 +69,8 @@ def _search_issue(item_id: str) -> dict | None:
             return None
         issues = json.loads(result.stdout)
         for issue in issues:
-            if item_id in issue.get("title", ""):
+            title = issue.get("title", "")
+            if re.search(rf"(?<!\w){re.escape(item_id)}(?!\w)", title):
                 return issue
         return None
     except Exception:

{pactkit-2.3.4 → pactkit-2.3.6}/src/pactkit/prompts/commands.py

@@ -86,53 +86,33 @@ allowed-tools: [Read, Write, Edit, Bash, Glob, Grep]
 1.  Run `pactkit next-id` to get the next Story ID (reads developer prefix from pactkit.yaml, scans `docs/specs/`).
 2.  **Output checkpoint**: Print "Story ID determined: {ID}. Writing Spec now."
 
-## 🎬 Phase 3.2a: Spec Skeleton (Metadata + Requirements)
-1.  **Create file**: Create `docs/specs/{ID}.md` with the following sections:
-    - **MUST — Metadata Table**: Include a metadata table at the top using this EXACT format:
-      ```markdown
-      | Field | Value |
-      |-------|-------|
-      | ID | {ID} |
-      | Status | Draft |
-      | Priority | P2 |
-      | Release | {version} |
-      ```
-      Field names MUST be exact case (ID, Status, Priority, Release) — not bold, not different names.
-    - **MUST**: Fill in the `Release` metadata field by reading the `version` field from `{PACTKIT_YAML}` or `pyproject.toml`. Use that EXACT value — do NOT increment or predict a future version. If the file cannot be read, use `TBD`.
-    - **MUST**: Include `## Background` and `## Target Call Chain` sections based on your Trace findings.
-    - **MUST**: Fill in the `## Requirements` section using RFC 2119 keywords (MUST/SHOULD/MAY).
-2.  **Output checkpoint**: Print "Spec skeleton written. Adding acceptance criteria."
+## 🎬 Phase 3.2a: Scaffold + Metadata Table & Requirements
+1.  **Scaffold**: Run `{SCAFFOLD_CMD} create_spec "{ID}" "{title}"` to generate `docs/specs/{ID}.md` from SPEC_TEMPLATE. This creates all sections, tables, and Given/When/Then skeleton — format is guaranteed by Code.
+2.  **Read**: Read `docs/specs/{ID}.md` to see the scaffolded template.
+3.  **Edit placeholders** (use Edit tool, NOT Write):
+    - Edit `Release | TBD` → `Release | {version}` (read version from `{PACTKIT_YAML}` or `pyproject.toml`; if unreadable, keep TBD)
+    - Edit `(Description of the problem or feature)` → actual Background content from your Trace findings
+    - Edit `## Target Call Chain` placeholder → actual call chain from Phase 1
+    - Edit `### R1: (Requirement Name) (MUST)` → actual requirements using RFC 2119 keywords (MUST/SHOULD/MAY). Add more R{N} sections as needed.
+4.  **Output checkpoint**: Print "Spec skeleton filled. Adding acceptance criteria."
 
 ## 🎬 Phase 3.2b: Acceptance Criteria & Implementation Steps
-1.  **MUST**: Add `## Acceptance Criteria` section with Given/When/Then scenarios.
+1.  **Edit AC** (use Edit tool): Replace `### AC1: (Scenario Name) (R1)` and its Given/When/Then placeholders with actual scenarios. The template already provides the `- **Given**` / `- **When**` / `- **Then**` structure — fill in the content. Add more AC{N} sections as needed.
     - Each Scenario SHOULD map to a verifiable test case in `docs/test_cases/`.
-2.  **OPTIONAL — Implementation Steps**: If Phase 1 Trace identifies 2+ files to modify, add `## Implementation Steps` section with table format:
-    ```
-    | Step | File | Action | Dependencies | Risk |
-    |------|------|--------|--------------|------|
-    | 1 | `src/foo.py` | Description | None | Low |
-    ```
-    The `Dependencies` column accepts `None`, `Step N`, or comma-separated step references. The `Risk` column accepts `Low`, `Medium`, `High`.
+2.  **Edit Implementation Steps** (optional): If Phase 1 Trace identifies 2+ files to modify, replace the placeholder rows in `## Implementation Steps` with actual steps. The table skeleton (headers + separator) is already in the template.
 3.  **Output checkpoint**: Print "Acceptance criteria written. Running security scope."
 
 ## 🎬 Phase 3.2c: Security Scope
-1.  **MUST**: Run `pactkit sec-scope <changed-files>` to auto-detect SEC-1~SEC-8 applicability. Append the output to `## Security Scope` in the Spec.
-2.  **Fallback**: If `pactkit sec-scope` is unavailable, manually assess each SEC-1 through SEC-8 check based on changed file paths and code patterns. Apply docs/tests-only shortcut if applicable (mark ALL N/A with Reason "docs/tests only").
-3.  **Output format** (the table must include a Reason column):
-    ```markdown
-    ## Security Scope
-    | Check | Applicable | Reason |
-    |-------|------------|--------|
-    | SEC-1 | Yes | Source code modified |
-    | SEC-2 | N/A | No user input handling |
-    ```
-4.  **Output checkpoint**: Print "Security scope appended. Running lint."
+1.  **MUST**: Run `pactkit sec-scope <changed-files>` to auto-detect SEC-1~SEC-8 applicability.
+2.  **Edit** the `## Security Scope` section already in the template: replace the placeholder SEC-1 row with actual SEC-* assessments from the output above. The table skeleton (Check/Applicable/Reason headers) is already in the template.
+3.  **Fallback**: If `pactkit sec-scope` is unavailable, manually Edit each SEC-1 through SEC-8 entry. Apply docs/tests-only shortcut if applicable (mark ALL N/A with Reason "docs/tests only").
+4.  **Output checkpoint**: Print "Security scope filled. Running lint."
 
 ## 🎬 Phase 3.2d: Spec Lint Self-Check
 1.  Run `pactkit spec-lint docs/specs/{ID}.md`.
-2.  If ERROR rules fail, self-correct the Spec immediately (you wrote it — you have authority to fix it). Re-run until clean.
+2.  If any ERROR or WARNING rules fire, self-correct the Spec immediately (you wrote it — you have authority to fix it). Re-run until `pactkit spec-lint` reports 0 errors AND 0 warnings.
 3.  This prevents the Spec from being rejected at Act Phase 0.5.
-4.  **Output checkpoint**: Print "Spec lint passed."
+4.  **Output checkpoint**: Print "Spec lint passed (0 errors AND 0 warnings)."
 
 ## 🎬 Phase 3.3: Board, Memory & Handover
 1.  **Board**: Add Story using `add_story`.
@@ -180,7 +160,8 @@ allowed-tools: [Read, Write, Edit, Bash, Glob, Grep]
 > **NON-BLOCKING**: This phase NEVER stops Act.
 1.  **Spec exists?**: Check if `docs/specs/{STORY_ID}.md` exists. If not: WARN "Spec not found".
 2.  **Board entry exists?**: Check if `{STORY_ID}` appears in `docs/product/sprint_board.md`. If not: WARN "Board entry not found".
-3.  **Continue**: Regardless of findings, proceed to Phase 1.
+3.  **Move to In Progress**: If `{STORY_ID}` is found on the board, move it to In Progress section.
+4.  **Continue**: Regardless of findings, proceed to Phase 1.
 
 ## 🎬 Phase 1: Precision Targeting
 1.  **Targeted Visual Scan**: Run `visualize --focus <module>` only (single targeted mode). For large codebases, add `--depth 2`. Do NOT run full 3-mode visualize here — that is handled by Phase 4 Lazy Visualize after implementation.
@@ -205,6 +186,7 @@ allowed-tools: [Read, Write, Edit, Bash, Glob, Grep]
     - Run `pactkit regression` (uses `git diff` + `LANG_PROFILES` to classify: SKIP/FULL/IMPACT). Doc-only changes are auto-skipped.
     - If IMPACT: run `pactkit test-map <changed-files>` for incremental test selection. If any changed file has 3+ importers in `code_graph.mmd`, run full suite. Fallback: full suite.
     - **CRITICAL — Pre-existing test failure protocol**: If a pre-existing test fails, **DO NOT modify** it. **STOP** and report to the user. This is a one-shot check, not an iterative loop.
+4.  **Lint Gate**: Run `pactkit lint` to check code style. If lint errors are found, fix them before proceeding. If `pactkit lint` is unavailable, run the stack's lint command directly.
 
 ## 🎬 Phase 4: Sync & Document
 1.  Run `pactkit clean` and `pactkit visualize --lazy` (runs file, `--mode class`, `--mode call` if source changed).

{pactkit-2.3.4 → pactkit-2.3.6}/src/pactkit/prompts/rules.py

@@ -356,7 +356,7 @@ When generating **any file** (code, document, test, HTML, etc.) that will exceed
 3. **Checkpoint between blocks**: After each Edit, print a brief progress message (e.g., "Block 2/5 written.")
 4. **Never accumulate**: Do NOT compose the entire file in reasoning before writing — write as you go
 
-## Applies To — any file type over 150 lines
+## Applies To — any file type over 300 lines
 - Documents: PRD, specs, README, architecture guides
 - Source code: large modules, multi-endpoint API files, data models
 - Tests: test files with many test classes or scenarios

{pactkit-2.3.4 → pactkit-2.3.6}/src/pactkit/prompts/workflows.py

@@ -738,7 +738,8 @@ Assign each Story to a horizon:
       - `## Requirements` — using RFC 2119 keywords (MUST/SHOULD/MAY)
       - `## Acceptance Criteria` — Given/When/Then scenarios
       - Add Priority Score to the spec header: `- **Priority**: {score} (Impact {I} / Effort {E})`
-4.  **Spec Lint Self-Check**: After each Spec is generated, run `pactkit spec-lint docs/specs/{STORY_ID}.md`. If ERRORs found, self-correct and re-run until clean. This prevents malformed Specs from blocking the Sprint pipeline at Act Phase 0.5.
+4.  **Security Scope**: After filling each Spec, run `pactkit sec-scope <changed-files>` to populate the `## Security Scope` section. If `pactkit sec-scope` is unavailable, manually fill SEC-1 through SEC-8.
+5.  **Spec Lint Self-Check**: After each Spec is generated, run `pactkit spec-lint docs/specs/{STORY_ID}.md`. If ERRORs found, self-correct and re-run until clean. This prevents malformed Specs from blocking the Sprint pipeline at Act Phase 0.5.
 5.  **Batch Checkpoint**: Every 3 Specs completed, print a progress checkpoint (e.g., "3/8 Specs created. Continuing."). This prevents unbounded continuous output.
 6.  **Dependency Graph**: Add a Mermaid dependency graph at the end of the PRD showing Story execution order and critical path.
 

{pactkit-2.3.4 → pactkit-2.3.6}/src/pactkit/schemas.py

@@ -18,14 +18,14 @@ When adding a new document type:
 
 SPEC_REQUIRED_METADATA_FIELDS = ("ID", "Status", "Priority", "Release")
 
-SPEC_REQUIRED_SECTIONS = ("## Requirements", "## Acceptance Criteria")
+SPEC_REQUIRED_SECTIONS = ("## Requirements", "## Acceptance Criteria", "## Security Scope")
 
 SPEC_OPTIONAL_SECTIONS = (
     "## Background",
     "## Target Call Chain",
     "## Implementation Steps",
-    "## Security Scope",
     "## Out of Scope",
+    "## Non-Goals",
 )
 
 # E004: requirement subsection pattern
@@ -45,6 +45,10 @@ import re as _re  # noqa: E402
 
 SPEC_RFC_PATTERN = _re.compile(r"\b(" + "|".join(SPEC_RFC_KEYWORDS) + r")\b")
 
+# E009: Security Scope section name and SEC-* entry pattern
+SPEC_SECURITY_SCOPE_SECTION = "Security Scope"
+SPEC_SEC_PATTERN = r"\|\s*SEC-"
+
 # ─── Spec Template ──────────────────────────────────────────────────────────
 # Used by scaffold.py create_spec(). Must be consistent with spec_linter rules.
 # IMPORTANT: scaffold.py (deployed as standalone script) inlines a copy of this
@@ -72,12 +76,28 @@ SPEC_TEMPLATE = """\
 
 ## Acceptance Criteria
 
-### AC1: (Scenario Name)
+### AC1: (Scenario Name) (R1)
 
 - **Given** (precondition)
 - **When** (action)
 - **Then** (expected result)
 
+## Target Call Chain
+
+(Trace call chain here)
+
+## Implementation Steps
+
+| Step | File | Action | Dependencies | Risk |
+|------|------|--------|-------------|------|
+| 1 | `src/example.py` | (Description) | None | Low |
+
+## Security Scope
+
+| Check | Applicable | Reason |
+|-------|------------|--------|
+| SEC-1 | N/A | (Reason) |
+
 ## Out of Scope
 
 - (Items explicitly excluded)

{pactkit-2.3.4 → pactkit-2.3.6}/src/pactkit/skills/scaffold.py

@@ -133,12 +133,28 @@ _SPEC_TEMPLATE = """\
 
 ## Acceptance Criteria
 
-### AC1: (Scenario Name)
+### AC1: (Scenario Name) (R1)
 
 - **Given** (precondition)
 - **When** (action)
 - **Then** (expected result)
 
+## Target Call Chain
+
+(Trace call chain here)
+
+## Implementation Steps
+
+| Step | File | Action | Dependencies | Risk |
+|------|------|--------|-------------|------|
+| 1 | `src/example.py` | (Description) | None | Low |
+
+## Security Scope
+
+| Check | Applicable | Reason |
+|-------|------------|--------|
+| SEC-1 | N/A | (Reason) |
+
 ## Out of Scope
 
 - (Items explicitly excluded)
@@ -190,7 +206,7 @@ def create_skill(name, desc, base_dir=None):
             "",
             "### [command_name] -- [Brief description]",
             "```",
-            f"python3 ~/.claude/skills/{name}/scripts/{clean}.py [subcommand] [args]",
+            f"python3 {root}/scripts/{clean}.py [subcommand] [args]",
             "```",
             "",
             "## Usage Scenarios",

{pactkit-2.3.4 → pactkit-2.3.6}/src/pactkit/skills/spec_linter.py

@@ -23,19 +23,25 @@ try:
         SPEC_REQUIRED_METADATA_FIELDS,
         SPEC_REQUIRED_SECTIONS,
         SPEC_REQUIREMENT_PATTERN,
+        SPEC_RFC_KEYWORDS,
         SPEC_RFC_PATTERN,
+        SPEC_SEC_PATTERN,
+        SPEC_SECURITY_SCOPE_SECTION,
         SPEC_VALID_STATUSES,
     )
 except ImportError:
     # Fallback for standalone execution without pactkit installed
     # Keep in sync with src/pactkit/schemas.py
     SPEC_REQUIRED_METADATA_FIELDS = ("ID", "Status", "Priority", "Release")
-    SPEC_REQUIRED_SECTIONS = ("## Requirements", "## Acceptance Criteria")
+    SPEC_REQUIRED_SECTIONS = ("## Requirements", "## Acceptance Criteria", "## Security Scope")
     SPEC_REQUIREMENT_PATTERN = r"### R\d+[:\s]"
     SPEC_AC_PATTERN = r"### AC\d+[:\s]|### Scenario\s+\d+[:\s]"
     SPEC_GIVEN_WHEN_THEN = ("Given", "When", "Then")
-    SPEC_RFC_PATTERN = re.compile(r"\b(MUST|SHOULD|MAY|SHALL|REQUIRED|RECOMMENDED|OPTIONAL)\b")
+    SPEC_RFC_KEYWORDS = ("MUST", "SHOULD", "MAY", "SHALL", "REQUIRED", "RECOMMENDED", "OPTIONAL")
+    SPEC_RFC_PATTERN = re.compile(r"\b(" + "|".join(SPEC_RFC_KEYWORDS) + r")\b")
     SPEC_VALID_STATUSES = ("Draft", "In Progress", "Done")
+    SPEC_SECURITY_SCOPE_SECTION = "Security Scope"
+    SPEC_SEC_PATTERN = r"\|\s*SEC-"
 
 # ---------------------------------------------------------------------------
 # Data types
@@ -171,7 +177,7 @@ def _check_requirements_section(text: str, result: LintResult) -> None:
         result.warnings.append(LintIssue("W003", "No RFC 2119 keywords (MUST/SHOULD/MAY) found in Requirements"))
 
 
-def _check_acceptance_criteria(text: str, result: LintResult) -> None:
+def _check_acceptance_criteria(text: str, result: LintResult, raw_text: str | None = None) -> None:
     """E005, E006, E007 — Acceptance Criteria section."""
     body = _section_text(text, "Acceptance Criteria")
 
@@ -187,17 +193,37 @@ def _check_acceptance_criteria(text: str, result: LintResult) -> None:
         )
         return
 
-    # E007: the AC section must contain Given, When, Then keywords
-    body_lower = body.lower()
-    # E007: use SPEC_GIVEN_WHEN_THEN from schemas (single source of truth)
-    missing = [kw for kw in SPEC_GIVEN_WHEN_THEN if kw.lower() not in body_lower]
-    if missing:
-        result.errors.append(LintIssue("E007", f"Acceptance Criteria missing keyword(s): {', '.join(missing).upper()}"))
+    # E007: each AC subsection must contain Given, When, Then keywords (per-subsection check)
+    # Use raw_text (with code blocks) for GWT search — specs may wrap Gherkin in ```gherkin fences
+    raw_body = (_section_text(raw_text, "Acceptance Criteria") if raw_text else None) or body
+    ac_matches = list(_AC_SUBSECTION.finditer(body))
+    raw_ac_matches = list(_AC_SUBSECTION.finditer(raw_body)) if raw_body != body else ac_matches
+    for i, m in enumerate(ac_matches):
+        # Extract AC ID from the heading (e.g., "AC1" or "Scenario 1")
+        ac_heading = m.group(0).strip()
+        ac_id_match = re.search(r"(AC\d+|Scenario\s+\d+)", ac_heading, re.IGNORECASE)
+        ac_id = ac_id_match.group(0) if ac_id_match else ac_heading
+        # Get subsection text from raw (preserves code block content for GWT search)
+        if i < len(raw_ac_matches):
+            raw_start = raw_ac_matches[i].end()
+            raw_end = raw_ac_matches[i + 1].start() if i + 1 < len(raw_ac_matches) else len(raw_body)
+            subsection_lower = raw_body[raw_start:raw_end].lower()
+        else:
+            start = m.end()
+            end = ac_matches[i + 1].start() if i + 1 < len(ac_matches) else len(body)
+            subsection_lower = body[start:end].lower()
+        # Word-boundary match to prevent "whenever" matching "when"
+        missing = [kw for kw in SPEC_GIVEN_WHEN_THEN if not re.search(r"\b" + kw.lower() + r"\b", subsection_lower)]
+        if missing:
+            result.errors.append(LintIssue("E007", f"{ac_id} missing keyword(s): {', '.join(missing).upper()}"))
 
 
 _PIPE_TABLE_ROW = re.compile(r"^\|.+\|.+\|", re.MULTILINE)
 
 # STORY-slim-024: R{N} ID extraction pattern
+# Uses \s+ instead of SPEC_REQUIREMENT_PATTERN's literal space to tolerate minor
+# whitespace variations in hand-written specs (e.g., tab or double-space after ###).
+# Adds capture group (R\d+) for ID extraction — SPEC_REQUIREMENT_PATTERN is match-only.
 _REQ_ID_PATTERN = re.compile(r"###\s+(R\d+)[:\s]", re.MULTILINE)
 
 
@@ -232,14 +258,13 @@ def _check_req_ac_coverage(text: str, result: LintResult) -> None:
     if not req_map:
         return  # No requirements found (handled by E004)
 
-    # Check each R{N} for coverage in AC section
-    ac_lower = ac_section.lower()
+    # Check each R{N} for coverage in AC section (word-boundary match)
     for req_id, req_body in req_map.items():
-        # Case-insensitive search for R{N} as word boundary
-        if req_id.lower() not in ac_lower:
-            # Check if the requirement uses SHOULD keyword
-            has_should = "SHOULD" in req_body.upper()
-            emphasis = " (SHOULD)" if has_should else ""
+        # STORY-slim-025 R4: use \b word boundary to prevent R1 matching R10/CR1/ERROR1
+        if not re.search(rf"\b{re.escape(req_id)}\b", ac_section, re.IGNORECASE):
+            # STORY-slim-025 R5: use SPEC_RFC_PATTERN (same as W003) for word-boundary keyword match
+            rfc_match = _RFC2119.search(req_body)
+            emphasis = f" ({rfc_match.group(0)})" if rfc_match else ""
             result.warnings.append(
                 LintIssue("W007", f"Requirement {req_id} has no corresponding AC reference{emphasis}")
             )
@@ -260,19 +285,45 @@ def _check_implementation_steps(text: str, result: LintResult) -> None:
         )
 
 
+# Canonical: src/pactkit/schemas.py SPEC_TEMPLATE
+_SCAFFOLD_PLACEHOLDERS = {
+    "Background": "(Description of the problem or feature)",
+    "Target Call Chain": "(Trace call chain here)",
+}
+
+
 def _check_optional_sections(text: str, result: LintResult) -> None:
-    """W001, W002, W004 — recommended sections."""
-    if _section_text(text, "Background") is None:
+    """W001, W002, W004, W008 — recommended sections and placeholder detection."""
+    bg = _section_text(text, "Background")
+    if bg is None:
         result.warnings.append(LintIssue("W001", "Missing '## Background' section (recommended)"))
+    elif _SCAFFOLD_PLACEHOLDERS["Background"] in bg:
+        result.warnings.append(LintIssue("W008", "## Background still contains scaffold placeholder text"))
 
-    if _section_text(text, "Target Call Chain") is None:
+    tcc = _section_text(text, "Target Call Chain")
+    if tcc is None:
         result.warnings.append(LintIssue("W002", "Missing '## Target Call Chain' section (recommended)"))
+    elif _SCAFFOLD_PLACEHOLDERS["Target Call Chain"] in tcc:
+        result.warnings.append(LintIssue("W008", "## Target Call Chain still contains scaffold placeholder text"))
 
     has_out_of_scope = _section_text(text, "Out of Scope") is not None or _section_text(text, "Non-Goals") is not None
     if not has_out_of_scope:
         result.warnings.append(LintIssue("W004", "Missing '## Out of Scope' or '## Non-Goals' section (recommended)"))
 
 
+_SEC_ROW = re.compile(SPEC_SEC_PATTERN, re.MULTILINE)
+
+
+def _check_security_scope(text: str, result: LintResult) -> None:
+    """E009 — Security Scope section must exist with SEC-* entries."""
+    body = _section_text(text, SPEC_SECURITY_SCOPE_SECTION)
+    if body is None:
+        result.errors.append(LintIssue("E009", f"Missing '## {SPEC_SECURITY_SCOPE_SECTION}' section"))
+        return
+    if not _SEC_ROW.search(body):
+        result.errors.append(LintIssue("E009", f"{SPEC_SECURITY_SCOPE_SECTION} section has no SEC-* entries"))
+
+
 # ---------------------------------------------------------------------------
 # Public API
 # ---------------------------------------------------------------------------
@@ -298,10 +349,11 @@ def validate_spec(spec_path: str) -> LintResult:
     result = LintResult()
     _check_metadata(text, result)
     _check_requirements_section(text, result)
-    _check_acceptance_criteria(text, result)
+    _check_acceptance_criteria(text, result, raw_text=raw)
     _check_optional_sections(text, result)
     _check_implementation_steps(text, result)
     _check_req_ac_coverage(text, result)  # STORY-slim-024: W007
+    _check_security_scope(text, result)  # STORY-slim-025: E009
     return result
 
 

{pactkit-2.3.4 → pactkit-2.3.6}/tests/unit/test_bug030_spec_lint_cli.py

@@ -39,11 +39,17 @@ This MUST work.
 
 ## Acceptance Criteria
 
-### AC1: Happy Path
+### AC1: Happy Path (R1)
 **Given** a valid spec
-**When** linted
+**When** R1 is linted
 **Then** passes
 
+## Security Scope
+
+| Check | Applicable | Reason |
+|-------|------------|--------|
+| SEC-1 | N/A | Test only |
+
 ## Out of Scope
 
 N/A